Security & data

What leaves your WordPress site, how each demo is kept apart from everything else, and how long we keep each kind of data.

What leaves your site

When you publish with the WordPress plugin, it shows you every plugin, theme, media folder and database table before anything is packaged, and you choose what goes in.

wp-config.php is never included, so your database password and security keys stay on your server.
Orders, customers, form entries and paid downloads are left out unless you include them. Payment tokens, API keys and webhooks are always left out.
Every user account that is included is scrubbed: logins, emails and passwords are replaced, and saved sessions, application passwords and billing and shipping addresses are removed. Commenter emails and IP addresses are blanked.
Caches, logs, other backup plugins’ folders, revisions and spam are always left out, as is the plugin’s own connect token.
Snapshots you download as .tdw files are encrypted (AES-256-GCM). Anyone who has the file can upload it to TryDemoWP, so share it only with people you trust.

How each demo is isolated

Every visitor gets their own container, their own copy of the database and their own database user, which can only read and write that copy.
Every demo gets its own login password, shown only on that demo’s login screen.
Containers run with every Linux capability they don’t need removed, cannot gain new privileges, and are capped at 256 MB of memory, half a CPU and 100 processes.
Imported sites run on a read-only filesystem, with plugin and theme installs and the file editor turned off. PHP files cannot run from the uploads folder, and uploads containing executable PHP there are rejected.
Demos cannot send email, and cannot make outbound web requests. Blank WordPress sites can reach wordpress.org only, so you can install plugins and themes.
Demos are firewalled from our application server and cannot reach the web server’s configuration.

How long we keep data

Data	How long
A live demo (its container, database copy and database user)Each visitor gets their own copy.	Deleted when its timer ends. The cleanup job runs every 30 seconds, and an hourly sweep removes anything a failed cleanup left behind.
Your uploaded archivesThe zip, .wpress or .tdw file you or the plugin uploaded.	Kept while the site exists. Deleted with the site. Uploads that never finish are deleted after 24 hours.
Your site template, image and media libraryWhat each demo is copied from.	Replaced when you upload a new version. Deleted with the site.
Demo sessionsDemo ID, start and end time, the visitor’s IP address.	Kept while the site exists, for your analytics. Deleted with the site.
LeadsEmail addresses visitors enter at your lead gate.	Kept while the site exists. Deleted with the site.
Buy-button clicksTime, IP address and browser of each click.	Kept while the site exists. Deleted with the site.
Processing logsThe steps each upload went through.	Deleted after 30 days, or with the site if that comes first.
Snapshot keysThe key that opens your encrypted .tdw snapshots.	Kept after the site is deleted, so a snapshot you downloaded earlier can still be uploaded.
BackupsA nightly copy of our database, every site template, and the archives and media you uploaded. A copy is stored on our server and a second copy with Cloudflare R2, in a private bucket.	Kept for 30 days. So anything you delete can remain in a backup for up to 30 days.

Deleting a site from your dashboard removes its demos, archives, template, image, media, sessions, leads, clicks and logs. To delete your whole account, email [email protected].

Planned: shorter retention

We’re tightening these. They aren’t in effect yet; the table above is what happens today.

Visitor IP addresses on demos and buy-button clicks, and the browser details on clicks: erased after 30 days.
Demo session and click records: deleted after 13 months.
An uploaded archive you’ve replaced: deleted 7 days after the newer one goes live. The latest one is always kept.

Reporting a problem

If you find a security issue, email [email protected]. See also our Privacy Policy.